From f658ef072394ff9fd28244ad475859c210e8ec16 Mon Sep 17 00:00:00 2001
From: bndw <ben@bdw.to>
Date: Sun, 15 Feb 2026 10:31:06 -0800
Subject: feat: track authorized (authenticated + successful) requests

Add 'authorized' status for requests that complete successfully after
authentication. This complements the existing 'unauthenticated' (pre-auth)
status tracking.

Now the dashboard shows:
- Authorized: Authenticated requests that succeeded
- Unauthorized: Authenticated requests rejected (not in allowlist)
- Pre-Auth: Requests sent before authentication

This gives full visibility into the auth flow:
1. Challenges: How many clients authenticated
2. Authorized: How many authenticated requests succeeded
3. Unauthorized: How many were rejected despite valid auth
4. Pre-Auth: How many tried before authenticating

Updated metrics:
- requests_total{status="authorized"} - authenticated successes
- requests_total{status="ok"} - unauthenticated successes (when no auth)
---
 internal/metrics/dashboard.html | 7 +++++++
 1 file changed, 7 insertions(+)

(limited to 'internal/metrics')

diff --git a/internal/metrics/dashboard.html b/internal/metrics/dashboard.html
index ab08eab..b7be1d7 100644
--- a/internal/metrics/dashboard.html
+++ b/internal/metrics/dashboard.html
@@ -171,6 +171,10 @@
                     <span class="metric-label">Challenges</span>
                     <span class="metric-value" id="auth_success">0</span>
                 </div>
+                <div class="metric">
+                    <span class="metric-label">Authorized</span>
+                    <span class="metric-value" id="auth_authorized">0</span>
+                </div>
                 <div class="metric">
                     <span class="metric-label">Unauthorized</span>
                     <span class="metric-value" id="auth_unauthorized">0</span>
@@ -309,6 +313,9 @@
                 document.getElementById('auth_success').textContent =
                     getMetricByLabel(metrics, `${prefix}_relay_auth_attempts_total`, 'result', 'success');
 
+                document.getElementById('auth_authorized').textContent =
+                    getMetricByLabel(metrics, `${prefix}_relay_requests_total`, 'status', 'authorized');
+
                 document.getElementById('auth_unauthorized').textContent =
                     getMetricByLabel(metrics, `${prefix}_relay_requests_total`, 'status', 'unauthorized');
 
-- 
cgit v1.2.3